CVE-2026-89699

Received Received - Intake

Memory Allocation Bypass in Linux Kernel NFS

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op that persists until compound teardown. The VFS rejects oversized targets with ENAMETOOLONG, but the allocation has already occurred. Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the allocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89699

EUVD

EUVD-2026-76611

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of symlink target length during NFSv4 CREATE operations. The function nfsd4_decode_create accepts an unbounded cr_datalen value from the network, allowing a client to request a large memory allocation (up to several megabytes) for each compound operation. This allocation persists until the operation completes, even though the VFS later rejects oversized targets with an error.

Detection Guidance

This vulnerability affects the Linux kernel's NFS server implementation. Detection requires checking kernel versions and NFS server configurations. Monitor kernel logs for ENAMETOOLONG errors during NFS CREATE operations. Use commands like 'dmesg | grep nfsd' or 'journalctl -u nfs-server' to inspect NFS-related errors. Ensure your kernel is updated to a patched version.

Impact Analysis

An attacker could exploit this to cause a denial of service by consuming excessive kernel memory, potentially leading to system slowdowns or crashes. Systems using NFSv4 with untrusted clients are most at risk.

Mitigation Strategies

Immediately update the Linux kernel to the latest stable version that includes the fix for CVE-2026-89699. Disable NFSv4 if not required. Restrict NFS exports to trusted networks using firewall rules. Monitor for unusual network activity targeting NFS ports (2049). Apply kernel patches if available from your distribution.

Hi! I’m here to help you understand CVE-2026-89699. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70